9

Our network install is not the best, so I need to tell applications that communicate over ssl to ignore the certificate. Had to do the same this with NPM, etc. So now when I run...

$ easy_install pip
...
Download error on https://pypi.python.org/simple/pip/: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590) -- Some packages may not be found!

So how do I turn off this validation?

P.S. I know this is a security vector but humor me.

Jackie
  • 21,969
  • 32
  • 147
  • 289
  • Instead of turning the certificate validation off you could check if updating the system root certificates would help – see [python easy_install fails with SSL certificate error for all packages](http://stackoverflow.com/q/21265616/95735) – Piotr Dobrogost Dec 05 '16 at 13:08

1 Answers1

10

I believe your easy_install ultimately goes to setuptools, which has its SSL helper. On my Linux it was at /usr/lib/python2.7/site-packages/setuptools/ssl_support.py. There are 2 ways from there basically:

  1. I would recommend obtaining the certificate and manually adding it, you will find the locations inside the ssl_support.py. These lines caught my attention:

    cert_paths = """
/etc/pki/tls/certs/ca-bundle.crt
/etc/ssl/certs/ca-certificates.crt
/usr/share/ssl/certs/ca-bundle.crt
/usr/local/share/certs/ca-root.crt
/etc/ssl/cert.pem
/System/Library/OpenSSL/certs/cert.pem
""".strip().split()

    Just append your certificate to any of them. See here how to obtain a certifiate using openssl s_client: Using openssl to get the certificate from a server

  2. Taking the humoring a bit further, you can completely disable SSL verification in your setuptools helper. The following lines in ssl_support.py caught my attention:

    try:
  import ssl
except ImportError:
  ssl = None

    I just added ssl = None after, so that:

    try:
  import ssl
except ImportError:
  ssl = None

ssl = None
Community
  • 1
  • 1
borancar
  • 1,109
  • 8
  • 10
  • 4
    Thank you, the problem itself is the the cert it is the signer. My employer essentially man in the middles all https requests on their network causing all SSL validation to have trouble. Point being I am not sure I can just add the cert and have it work but I am not a security pro. – Jackie Oct 02 '15 at 15:31
  • @Jackie which solution work for you? I stuck to same issue :( – Nilesh Jan 25 '18 at 21:18